403 page parses the permission name back out of the error message string #518

Tier 3: brittle coupling

Problem

framework/hosting/simple_module_hosting/_error_handlers.py:58-75 works out which permission was missing by checking message.startswith(PERMISSION_DENIED_PREFIX) (the prefix is defined at simple_module_core/permissions.py:39) and slicing the string.

If the guard's message is reworded or translated, the 403 page silently loses the "you need permission X" detail. No test or type links the two.

Fix

Raise a PermissionDenied(HTTPException) subclass that carries .permission. Have the handler use isinstance and read the attribute, and keep the message for humans only.